A new campaign coined “Stayin’ Alive” has been discovered, appearing to originate from the Chinese espionage actor known as ToddyCat. The campaign has been ongoing since 2021 and targets include government and telecom organizations located in Vietnam, Uzbekistan, Pakistan, and Kazakhstan, with the main objective of deploying basic backdoors and loaders for the delivery of next-stage malware. Researchers have tied the threat actor to a wide variation of custom tools believed to be disposable which helps them evade detection and prevent linking attacks together. While there is no clear code overlap with any other known toolsets used by other actors, the utilization of the same set of infrastructure is what researchers are focusing on to link this campaign to ToddyCat, who have been running cyber assaults against government and military agencies in Europe and Asia dating back to at least December 2020. Stayin’ Alive attacks begin with spear-phishing emails that urge recipients to open a malicious ZIP file attachment containing a legitimate executable but exploits CVE-2022-23748, a vulnerability in Audinate’s Dante Discovery software, to preform DLL side-loading and download “CurKeep” malware. CurKeep is a backdoor designed to send information about the compromised host to a remote server, execute commands sent by the server, and write server responses to files on the system. The threat actor has also been observed using a passive implant named “StylerServ” that listens on five (5) different ports (60810, 60811, 60812, 60813, and 60814) to accept a remote connection and receive an encrypted configuration file. The key takeaway is that the use of disposable loaders and downloaders has become more common even among sophisticated actors making detection and attribution more difficult, so even though the Stayin’ Alive campaign and ToddyCat threat actors both utilize the same infrastructure and pursue similar sets of targets, conclusively linking them together is being made more difficult. Indicators of compromise (IOCs) can be viewed in the report linked below.